Linux Commands Cheat Sheet for Beginners (The 40 That Cover Almost Everything)

Linux Commands Cheat Sheet for Beginners

Linux commands are the highest-return thing a beginner in software can memorise, and the reason is unusual: they do not change.

The grep flags you learn this week were correct twenty years ago and will be correct twenty years from now. They work identically on macOS. They work on Windows through WSL. They work on every server you will ever deploy to, inside every Docker container, and in every CI pipeline. Almost nothing else in this industry has that shelf life.

This sheet covers roughly forty commands, grouped by what you are trying to do rather than alphabetically.

Updated for 2026. Works on Linux, macOS, and WSL unless noted.

Navigation and Looking Around

Start here. These commands cannot break anything, which makes them the right place for a beginner to build confidence.

pwd                 # where am I
ls                  # list files
ls -lah             # long format, all files, human-readable sizes
cd /path/to/dir     # go somewhere
cd ..               # up one level
cd -                # back to the previous directory
cd                  # home directory
tree -L 2           # directory tree, 2 levels deep

ls -lah is the one to memorise as a single unit. -l gives the long format with permissions and sizes, -a includes hidden dotfiles, and -h prints sizes as 4.2K instead of 4300. Almost nobody types plain ls after learning it.

cd - is the underused one. It returns you to wherever you just were, like a back button. When you are jumping between a config directory and a source directory repeatedly, it saves a great deal of typing.

Reading Files

cat file.txt              # print whole file
less file.txt             # scrollable viewer (q to quit)
head -20 file.txt         # first 20 lines
tail -20 file.txt         # last 20 lines
tail -f app.log           # follow a file as it grows
wc -l file.txt            # count lines

tail -f is the command you will use most often in real work. It follows a log file live, printing new lines as they are written. When something is failing in production, this is usually the first thing you run.

Combine it for the common case:

tail -f app.log | grep ERROR

That streams only the error lines as they appear, which is the difference between watching a log and drowning in one.

A warning about cat: never cat a file you have not checked the size of. cat on a 2GB log file will flood your terminal for several minutes. Use less when you are unsure — it pages, and q exits.

Creating, Copying, and Moving

mkdir newdir              # create a directory
mkdir -p a/b/c            # create nested directories
touch file.txt            # create empty file / update timestamp
cp file.txt backup.txt    # copy a file
cp -r dir/ backup/        # copy a directory recursively
mv old.txt new.txt        # rename
mv file.txt ~/Documents/  # move

mkdir -p creates every parent directory in the path and does not error if they already exist. It is what you want in scripts, essentially always.

Deleting — Read This Section Carefully

rm file.txt               # delete a file
rm -r dir/                # delete a directory and contents
rm -i file.txt            # ask before deleting

Linux has no recycle bin. rm is permanent. There is no undo, no trash folder, and no recovery short of specialist forensic tools.

Three rules that prevent the disaster:

Never combine -r and -f without reading the path twice. rm -rf deletes recursively and silently, ignoring errors. The reason it is famous is that a single misplaced space — rm -rf / home/user/temp instead of rm -rf /home/user/temp — targets the root of the filesystem.

Never use an unquoted variable in an rm command. If $DIR is empty, rm -rf $DIR/ becomes rm -rf /. Always write rm -rf "$DIR".

Run ls on the path first. Whatever ls prints is what rm will destroy. This one habit costs two seconds and has saved a great many careers.

File Permissions

This is where beginners get stuck, and it is genuinely simple once the arithmetic is visible.

chmod 755 script.sh       # rwx for owner, r-x for everyone else
chmod 644 file.txt        # rw- for owner, r-- for everyone else
chmod +x script.sh        # just make it executable
chown user:group file     # change owner and group
ls -l                     # view current permissions

Each permission has a number:

Add them for each of the three audiences — owner, group, others:

On 777: it appears in a great many tutorials as a fix for permission errors, and it works the way removing a lock fixes a jammed door. It grants every user on the system full control of the file. If that file is a script that runs automatically, anyone with any access to the machine can replace its contents and have them executed. The correct fix is nearly always chown to the right user, then 644 or 755.

Searching

grep "text" file.txt              # find text in a file
grep -r "text" .                  # search recursively from here
grep -rn "text" .                 # with line numbers
grep -i "text" file.txt           # case-insensitive
grep -v "text" file.txt           # invert: lines NOT matching
grep -c "text" file.txt           # count matches

find . -name "*.log"              # find by filename pattern
find . -type d -name "node_modules"  # find directories
find . -mtime -7                  # modified in the last 7 days
find . -size +100M                # larger than 100MB

grep -rn is the workhorse — recursive, with line numbers, so the output is directly navigable. It is probably the single most-typed search command in existence.

If you work in codebases, install ripgrep and use rg instead. It respects .gitignore, skips binary files, and is substantially faster:

rg "functionName"          # same idea, faster, gitignore-aware

The find and delete combination deserves its own line, because it is genuinely useful and genuinely dangerous:

find . -name "*.tmp" -print     # ALWAYS run this first
find . -name "*.tmp" -delete    # only after checking the list

Print, read, then delete. Never the other way around.

Processes

ps aux                    # all running processes
ps aux | grep node        # find a specific process
top                       # live process monitor
htop                      # nicer live monitor (usually needs installing)
kill <pid>                # ask a process to stop
kill -9 <pid>             # force a process to stop
pkill -f "node server"    # kill by matching the command

kill versus kill -9: plain kill sends SIGTERM, which asks the process to shut down cleanly — flush its buffers, close its database connections, finish writing files. kill -9 sends SIGKILL, which the process cannot catch or handle; it stops instantly, mid-write if necessary.

Always try kill first. Reach for -9 only when the process ignores it. Using -9 by reflex on a database is how you get a corrupted data file.

Disk and System

df -h                     # disk space by filesystem
du -sh *                  # size of each item here
du -sh * | sort -h        # ...sorted smallest to largest
free -h                   # memory usage (Linux)
uname -a                  # system and kernel info
uptime                    # how long the machine has been up, load average

du -sh * | sort -h is the answer to "the disk is full and I do not know why." Run it at the root of the suspicious directory, look at the largest entry, cd into it, and repeat. Three or four iterations finds the culprit almost every time.

Networking

curl https://example.com          # fetch a URL
curl -I https://example.com       # headers only
ping example.com                  # basic reachability
dig example.com                   # DNS lookup
lsof -i :3000                     # what is using port 3000
ss -tulpn                         # all listening ports

lsof -i :3000 solves the most common local development error there is. "Port already in use" is almost always a previous run of your own server that never shut down. This tells you its process ID; kill it and start again.

ss has largely replaced netstat on modern distributions. If a tutorial tells you to use netstat and it is not installed, ss -tulpn is the equivalent.

Pipes and Redirection

This is what makes the shell powerful rather than merely convenient.

command > file.txt        # write output to a file (overwrites)
command >> file.txt       # append to a file
command 2> errors.txt     # write errors to a file
command > out.txt 2>&1    # write both output and errors
command < input.txt       # read input from a file
cmd1 | cmd2               # pipe output of cmd1 into cmd2

The pipe is the central idea. Each command does one thing, and you chain them:

cat access.log | grep "404" | wc -l
# how many 404s are in this log

ps aux | grep node | grep -v grep
# all node processes, excluding the grep itself

history | grep docker
# every docker command you have ever run

2>&1 is the piece of syntax everyone looks up forever. It means "send stream 2 (errors) to wherever stream 1 (output) is going." It goes after the redirect, not before — > out.txt 2>&1 works, 2>&1 > out.txt does not do what you expect.

Compression

tar -czf archive.tar.gz dir/     # create a gzipped archive
tar -xzf archive.tar.gz          # extract it
tar -tzf archive.tar.gz          # list contents without extracting
zip -r archive.zip dir/          # create a zip
unzip archive.zip                # extract a zip

The tar flags are the classic memorisation failure. A mnemonic that works: create, extract, list; z for gzip, f for file, v for verbose if you want to watch it work.

Always run tar -tzf before extracting an archive from an untrusted source. It lists the contents without writing anything, which tells you whether the archive politely contains one folder or is about to scatter two hundred files into your current directory.

The Five Mistakes That Cost People Data

1. rm -rf with an unquoted or empty variable. Quote every path. Always.

2. chmod 777 to fix a permission error. It opens the file to every user and process on the machine. Use chown plus the minimum permission instead.

3. kill -9 on a database or a process mid-write. Try plain kill first and give it a few seconds.

4. Redirecting into the file you are reading. sort file.txt > file.txt empties the file before sort reads it. Write to a temporary file and move it.

5. Running an unfamiliar command from the internet with sudo. sudo disables the safety net that stops a mistake from becoming a system-wide problem. Read the command; if you cannot explain what it does, do not run it as root.

Print This Section

NAVIGATE   pwd · ls -lah · cd - · tree -L 2
READ       less · tail -f · head -20 · wc -l
SEARCH     grep -rn "x" .  ·  find . -name "*.log"
PROCESS    ps aux | grep x  ·  lsof -i :3000  ·  kill <pid>
DISK       df -h  ·  du -sh * | sort -h
PERMS      644 files · 755 scripts/dirs · 600 keys · never 777

BEFORE rm:   run ls on the same path first
BEFORE tar:  run tar -tzf to see what is inside

Linux is one of the few skills in software where the effort you spend now stays valid for your entire career. Thirty commands, learned properly once, cover the overwhelming majority of what you will ever need.

🔗 Next in this collection: Git Commands Cheat Sheet for Daily Use, or return to The Complete Developer Cheat Sheet Collection.